Deployment Sovereignty
The Vault is designed to give organisations full control over where and how their custody infrastructure runs. Choose from two deployment models depending on your data residency requirements, operational capacity, and regulatory obligations.
Deployment Models at a Glance
| SaaS | On-Premises | |
|---|---|---|
| Infrastructure | Managed by The Vault | Fully customer-managed |
| Key share custody | Server shares in The Vault cloud | All shares on customer infrastructure |
| Data residency | The Vault cloud region | Fully within customer perimeter |
| Operational burden | Minimal | Full |
| Time to go live | Days | 2–4 weeks |
| Best for | Startups, fintechs | Banks, institutions with strict data residency |
SaaS (Cloud-Hosted)
The fully managed option. All platform services, server signers, and data are hosted in The Vault’s cloud infrastructure.
You manage:
- API integration from your application
- Mobile signer devices (your team holds them)
- Transaction policies and approval workflows
- Contracts and API credentials for the AML providers you use, entered in the dashboard (see AML Screening)
We manage:
- Infrastructure, uptime, scaling, and monitoring
- Database backups and disaster recovery
- Server signer availability and key share encryption
- Software upgrades and security patches
- Deployment-level configuration of the optional modules: AML provider endpoints and block thresholds, and the staking provider connection
Even in SaaS mode, when the key includes mobile signers, every signing session requires at least one of them, so The Vault cloud alone cannot move funds.
On-Premises (Self-Hosted)
The full sovereignty option. Every component — services, signers, database, and key material — runs within your own network perimeter.
You manage:
- Compute platform provisioning and maintenance
- All Vault services (deployed from the platform’s deployment package)
- Database hosting, backups, and disaster recovery
- KMS configuration and key management
- Network security, TLS certificates, and access controls
- Software upgrades (new releases provided by The Vault)
- The external services the platform calls out to, where you enable them: AML provider endpoints, credentials and block thresholds, and the staking provider connection, network and super-representative allow-list
We provide:
- The deployment package, installation runbook, and operator CLI
- Technical onboarding and upgrade guidance
- Security advisories and patch releases
On-premises deployment supports the same API surface and feature set as the cloud deployment. The only difference is infrastructure ownership and operational responsibility.
Key Sovereignty
Across all deployment models, The Vault’s configurable k-of-n MPC threshold ensures that no single party can unilaterally move funds.
| Deployment | Who holds key shares | Can The Vault move funds alone? |
|---|---|---|
| SaaS | 2 server shares (The Vault cloud) + 2 mobile shares (your devices) | No, if a mobile signer is configured — it must take part in every signing session |
| On-Premises | 2 server shares (your infra) + 2 mobile shares (your devices) | N/A — The Vault has no access |
Data Residency
With on-premises deployment, you control where sensitive data lives:
| Data Type | SaaS | On-Premises |
|---|---|---|
| Encrypted key shares | The Vault cloud | Your infrastructure |
| Transaction records | The Vault cloud | Your infrastructure |
| Audit logs | The Vault cloud | Your infrastructure |
| User identity data | The Vault cloud | Your infrastructure |
| KMS root key | The Vault-managed KMS | Your KMS |
If your organisation is subject to data residency regulations (e.g., GDPR, MAS TRM, local banking rules), consider on-premises deployment to ensure all regulated data remains within your jurisdictional boundary.
Choosing a Model
I want to move fast
SaaS is the right choice. You get a production-ready custody platform in days, with no infrastructure to manage. You still hold mobile signer devices, so funds cannot move without your explicit participation.
Next Steps
- On-Premises Installation — deployment overview, prerequisites, and what’s in the onboarding package
- Key Backup — backup procedures for each deployment model
- Operations — monitoring, backup, disaster recovery, and upgrades